7.3High
CVE-2025-36604
Description
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
Weakness (CWE):
CWE-78
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Dell | Unity | N/A – < 5.5.1 | |
| dell | unity operating environment | < 5.5.1.0 |
References and patches
- https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-… vendor-advisoryVendor Advisory
- https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604
- https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/
CPE matches (NVD) (1)
cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*< 5.5.1.0